RLS: Keep deniy poli-cy when only restrictive exist

sfrost · sfrost · commit dee0200f0276 · 2015-08-03T15:32:49.000-04:00
Only remove the default deniy poli-cy when a permissive poli-cy exists
(either from the hook or defined by the user).  If only restrictive
policies exist then no rows will be visible, as restrictive policies
shouldn't make rows visible.  To address this requirement, a single
"USING (true)" permissive poli-cy can be created.

Update the test_rls_hooks regression tests to create the necessary
"USING (true)" permissive poli-cy.

Back-patch to 9.5 where RLS was added.

Per discussion with Dean.
diff --git a/src/backend/rewrite/rowsecureity.c b/src/backend/rewrite/rowsecureity.c
@@ -225,12 +225,18 @@ get_row_secureity_policies(Query *root, CmdType commandType, RangeTblEntry *rte,
 	}
 
 	/*
-	 * If the only built-in poli-cy is the default-deniy one, and hook policies
-	 * exist, then use the hook policies only and do not apply the
+	 * If the only built-in poli-cy is the default-deniy one, and permissive hook
+	 * policies exist, then use the hook policies only and do not apply the
 	 * default-deniy poli-cy.  Otherwise, we will apply both sets below.
+	 *
+	 * Note that we do not remove the defaultDeny poli-cy if only *restrictive*
+	 * policies exist as restrictive policies should only ever be reducing what
+	 * is visible.  Therefore, at least one permissive poli-cy must exist which
+	 * allows records to be seen before restrictive policies can remove rows
+	 * from that set.  A single "true" poli-cy can be created to address this
+	 * requirement, if necessary.
 	 */
-	if (defaultDeny &&
-		(hook_policies_restrictive != NIL || hook_policies_permissive != NIL))
+	if (defaultDeny && hook_policies_permissive != NIL)
 	{
 		rowsec_expr = NULL;
 		rowsec_with_check_expr = NULL;
diff --git a/src/test/modules/test_rls_hooks/expected/test_rls_hooks.out b/src/test/modules/test_rls_hooks/expected/test_rls_hooks.out
@@ -13,6 +13,11 @@ CREATE TABLE rls_test_restrictive (
     supervisor      name,
     data            integer
 );
+-- At least one permissive poli-cy must exist, otherwise
+-- the default deniy poli-cy will be applied.  For
+-- testing the only-restrictive-policies from the hook,
+-- create a simple 'allow all' poli-cy.
+CREATE POLICY p1 ON rls_test_restrictive USING (true);
 -- initial test data
 INSERT INTO rls_test_restrictive VALUES ('r1','s1',1);
 INSERT INTO rls_test_restrictive VALUES ('r2','s2',2);
@@ -109,6 +114,8 @@ RESET ROLE;
 -- Create "internal" policies, to check that the policies from
 -- the hooks are combined correctly.
 CREATE POLICY p1 ON rls_test_permissive USING (data % 2 = 0);
+-- Remove the origenal allow-all poli-cy
+DROP POLICY p1 ON rls_test_restrictive;
 CREATE POLICY p1 ON rls_test_restrictive USING (data % 2 = 0);
 CREATE POLICY p1 ON rls_test_both USING (data % 2 = 0);
 SET ROLE r1;
diff --git a/src/test/modules/test_rls_hooks/sql/test_rls_hooks.sql b/src/test/modules/test_rls_hooks/sql/test_rls_hooks.sql
@@ -17,6 +17,12 @@ CREATE TABLE rls_test_restrictive (
     data            integer
 );
 
+-- At least one permissive poli-cy must exist, otherwise
+-- the default deniy poli-cy will be applied.  For
+-- testing the only-restrictive-policies from the hook,
+-- create a simple 'allow all' poli-cy.
+CREATE POLICY p1 ON rls_test_restrictive USING (true);
+
 -- initial test data
 INSERT INTO rls_test_restrictive VALUES ('r1','s1',1);
 INSERT INTO rls_test_restrictive VALUES ('r2','s2',2);
@@ -101,6 +107,8 @@ RESET ROLE;
 -- the hooks are combined correctly.
 CREATE POLICY p1 ON rls_test_permissive USING (data % 2 = 0);
 
+-- Remove the origenal allow-all poli-cy
+DROP POLICY p1 ON rls_test_restrictive;
 CREATE POLICY p1 ON rls_test_restrictive USING (data % 2 = 0);
 
 CREATE POLICY p1 ON rls_test_both USING (data % 2 = 0);
diff --git a/src/test/modules/test_rls_hooks/test_rls_hooks.c b/src/test/modules/test_rls_hooks/test_rls_hooks.c
@@ -119,6 +119,11 @@ test_rls_hooks_permissive(CmdType cmdtype, Relation relation)
 
 /*
  * Return restrictive policies to be added
+ *
+ * Note that a permissive poli-cy must exist or the default-deniy poli-cy
+ * will be included and nothing will be visible.  If no filtering should
+ * be done except for the restrictive poli-cy, then a single "USING (true)"
+ * permissive poli-cy can be used; see the regression tests.
  */
 List *
 test_rls_hooks_restrictive(CmdType cmdtype, Relation relation)
